{"id":"CVE-2019-1020012","aliases":["EUVD-2019-0487","GHSA-2479-qvv7-47qq"],"status":"published","title":"Parse Server before v3.4.1 vulnerable to Denial of Service","description":"parse-server before 3.4.1 allows DoS after any POST to a volatile class.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01399,"percentile":0.72861,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2019-06-13T16:22:13Z","modified":"2026-10-20T10:50:38Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["3.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.1"}]}]}],"products":[{"vendor":"parse","product":"parse-server"},{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1020012","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2479-qvv7-47qq","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PARSESERVER-455635","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1113","tags":["web"]},{"url":"https://github.com/parse-community/parse-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-1020012","description":"parse-server before 3.4.1 allows DoS after any POST to a volatile class.","status":"published","published":"2019-07-29T12:16:14Z","modified":"2024-08-05T03:14:16.043Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-0487","description":"parse-server before 3.4.1 allows DoS after any POST to a volatile class.","status":"published","published":"2019-07-29T12:16:14Z","modified":"2024-08-05T03:14:16Z","updated_at":"2026-11-03T02:40:18.31448Z"}],"ghsa":[{"id":"GHSA-2479-qvv7-47qq","title":"Parse Server before v3.4.1 vulnerable to Denial of Service","description":"### Impact\n\nIf a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).\n\n\n### Patches\nAfflicted installations will also have to remove the offending collection from their database.\n\nYes, patched in 3.4.1\n\n### Workarounds\n\nYes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5\n\n### References\nNothing other than this advisory at this time\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [parse-server](https://github.com/parse-community/parse-server)\n* Email us at [security@parseplatform.org](mailto:security@parseplatform.org)\n","status":"published","published":"2019-06-13T16:22:13Z","modified":"2023-01-08T05:03:02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"nvd":[{"id":"CVE-2019-1020012","description":"parse-server before 3.4.1 allows DoS after any POST to a volatile class.","status":"published","published":"2019-07-29T13:15:11.827Z","modified":"2026-06-17T02:10:00.7Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-1020012","description":"parse-server before 3.4.1 allows DoS after any POST to a volatile class.","status":"published","published":"2019-07-29T13:15:11.827Z","modified":"2026-10-20T10:50:38.367235748Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-2479-qvv7-47qq","title":"Parse Server before v3.4.1 vulnerable to Denial of Service","description":"### Impact\n\nIf a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).\n\n\n### Patches\nAfflicted installations will also have to remove the offending collection from their database.\n\nYes, patched in 3.4.1\n\n### Workarounds\n\nYes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5\n\n### References\nNothing other than this advisory at this time\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [parse-server](https://github.com/parse-community/parse-server)\n* Email us at [security@parseplatform.org](mailto:security@parseplatform.org)\n","status":"published","published":"2019-06-13T16:22:13Z","modified":"2026-09-10T03:48:13.370851332Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}